Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A backdoor in a LinkedIn job offer

roman.pt

Post reply on HN
Print view View original

41–50 of 331 posts

Re: A backdoor in a LinkedIn job offer

#41

Post by mgiampapa »

Barbing wrote: post #26
bityard wrote: post #20

Earlier quoted context omitted.

To put it bluntly and perhaps a bit cynically, on the tree of bad things that people do to other people, this is pretty high-hanging fruit. Right up there next to scam phone calls that prey on the elderly while claiming to be from Microsoft support. It's basically impossible to catch suspects because they are either smart enough to cover their tracks very well, or (more often) live in countries whose governments don'…

Saw Microsoft has a dedicated scam reporting page - guess it was damaging their brand https://reportfraud.microsoft.com/en-us Wonder if they’re effective in going after reports. I’d still report to IC3/FBI/powers that be, too. Just in case someone somewhere has the resources to do something… perhaps a high hope

I get more calls from Google Security than any other thing. Oddly the Pixel's built in scam detection and call screening lets them through without fail. I normally don't have my phone even ring unless it's in my contacts, but saying you are calling from Google is like a magic code.

Re: A backdoor in a LinkedIn job offer

#42

Post by burnte »

wxw wrote: post #16

> a recruiter at a small crypto startup [...] she described a broken proof-of-concept they needed a lead engineer for, and then sent me a public GitHub repo to review. Specifically, she asked me to “check out the deprecated Node modules issue.” > ...buried between walls of commented-out tests, the payload runs anything the server sends back to your machine. > npm runs prepare automatically after npm install, so just…

I haven't been phished like this but I've certainly had fraudsters try to con me into meetings or schemes, etc.

Re: A backdoor in a LinkedIn job offer

#43

Post by throwaway85825 »

jmward01 wrote: post #8

So, this is a crime right? Why isn't there a well known '911' for cybercrime to report things like this to and get help? Society needs to catch up with the actual dangers out there and build support networks for this ASAP. This is organized crime and needs organized defense to deal with it.

The scammers are in a different whole uncooperative country.

Re: A backdoor in a LinkedIn job offer

#44

Post by Xirdus »

bityard wrote: post #20
jmward01 wrote: post #8

So, this is a crime right? Why isn't there a well known '911' for cybercrime to report things like this to and get help? Society needs to catch up with the actual dangers out there and build support networks for this ASAP. This is organized crime and needs organized defense to deal with it.

To put it bluntly and perhaps a bit cynically, on the tree of bad things that people do to other people, this is pretty high-hanging fruit. Right up there next to scam phone calls that prey on the elderly while claiming to be from Microsoft support. It's basically impossible to catch suspects because they are either smart enough to cover their tracks very well, or (more often) live in countries whose governments don'…

Hard disagree on the scam phone calls. It would be trivial to eradicate them almost completely if the phone operators did the bare minimum to fight against it. At any point in time, any given US phone number is handled by exactly one phone carrier. There is nothing stopping that carrier from requiring name and address to issue that phone number. They already do for 99.99% of their legitimate customers. It would be very easy to make it so that every single phone call originating from the US, including all VOIP calls made with US phone numbers, can be traced back to a specific business or person that can later be sued or prosecuted.

And no, number spoofing isn't an excuse either. We literally solved the much harder problem of email spoofing already. There are, what, 3 carrier networks in all of US? And they cannot do with each other what DMARC did for the hundreds of thousands disjoint organizations that comprise the internet? Please.

Re: A backdoor in a LinkedIn job offer

#45

Post by deejaaymac »

jmward01 wrote: post #8

So, this is a crime right? Why isn't there a well known '911' for cybercrime to report things like this to and get help? Society needs to catch up with the actual dangers out there and build support networks for this ASAP. This is organized crime and needs organized defense to deal with it.

Cool let's hear your solution, you seem well versed on how infosec works.

Re: A backdoor in a LinkedIn job offer

#46

Post by throwaway85825 »

mgiampapa wrote: post #41
Barbing wrote: post #26

Earlier quoted context omitted.

Saw Microsoft has a dedicated scam reporting page - guess it was damaging their brand https://reportfraud.microsoft.com/en-us Wonder if they’re effective in going after reports. I’d still report to IC3/FBI/powers that be, too. Just in case someone somewhere has the resources to do something… perhaps a high hope

I get more calls from Google Security than any other thing. Oddly the Pixel's built in scam detection and call screening lets them through without fail. I normally don't have my phone even ring unless it's in my contacts, but saying you are calling from Google is like a magic code.

They must have whitelisted the word Google. Very useful to scammers.

Re: A backdoor in a LinkedIn job offer

#47

Post by cluckindan »

jmward01 wrote: post #8

So, this is a crime right? Why isn't there a well known '911' for cybercrime to report things like this to and get help? Society needs to catch up with the actual dangers out there and build support networks for this ASAP. This is organized crime and needs organized defense to deal with it.

Yes. But the perps are in North Korea.

Re: A backdoor in a LinkedIn job offer

#48

Post by winddude »

gleenn wrote: post #32
wxw wrote: post #16

> a recruiter at a small crypto startup [...] she described a broken proof-of-concept they needed a lead engineer for, and then sent me a public GitHub repo to review. Specifically, she asked me to “check out the deprecated Node modules issue.” > ...buried between walls of commented-out tests, the payload runs anything the server sends back to your machine. > npm runs prepare automatically after npm install, so just…

Friends don't let friends use NPM. At this point it is so wildly crazy watching people get owned, I don't understand how anyone uses it when they could use e.g. PNMPM and block one if the most obvious and frequently exploited holes. These tools with arbitrary code execution when trying to download some code have got to stop. Edit: typos

> Friends don't let friends ise NPM

or linkedin

Re: A backdoor in a LinkedIn job offer

#49

Post by a34729t »

Xirdus wrote: post #44
bityard wrote: post #20

Earlier quoted context omitted.

To put it bluntly and perhaps a bit cynically, on the tree of bad things that people do to other people, this is pretty high-hanging fruit. Right up there next to scam phone calls that prey on the elderly while claiming to be from Microsoft support. It's basically impossible to catch suspects because they are either smart enough to cover their tracks very well, or (more often) live in countries whose governments don'…

Hard disagree on the scam phone calls. It would be trivial to eradicate them almost completely if the phone operators did the bare minimum to fight against it. At any point in time, any given US phone number is handled by exactly one phone carrier. There is nothing stopping that carrier from requiring name and address to issue that phone number. They already do for 99.99% of their legitimate customers. It would be ve…

Yeah 100%. It's criminal that this is not already done.

Re: A backdoor in a LinkedIn job offer

#50

Post by pocksuppet »

john_strinlai wrote: post #17
jmward01 wrote: post #8

So, this is a crime right? Why isn't there a well known '911' for cybercrime to report things like this to and get help? Society needs to catch up with the actual dangers out there and build support networks for this ASAP. This is organized crime and needs organized defense to deal with it.

the main issue is that we lack a global '911'. secondary is the effort asymmetry between spinning up one of these scams (near 0 effort) and catching/prosecuting these scams (big effort, astronomical cost)

what about the outcome asymmetry between spinning up one of these scams (get one guy's computer) and getting caught (jail for life)
Post reply on HN